Get access to immediate incident response assistance.
Eliminate active threats with 24/7 threat detection, investigation, and response.
Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.
Advance your cybersecurity program and get expert guidance where you need it most.
Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.
Prevent unauthorized access and exceed compliance requirements.
Stop email threats others miss and secure your organization against the #1 ransomware attack vector.
Prepare for the inevitable with 24/7 global breach response in-region and available on-site.
Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.
How can I configure the scanning server to work with native FTP?
In order to enable the scanner to scan native FTP sessions:
1. In Versions 8.5: Log in to the managment console and go to Settings -> Devices -> Scanner IP -> FTP. In Version 9.0 and above: Log in to the management console and go to Administration -> System Settings -> Finjan Devices -> Scanner IP -> FTP.
2. In the FTP Configuration mark the ‘Enable FTP’ check box and other settings if needed.
3. Apply and commit the changes.
4. In order to check that the scanner actually scan the FTP data, here are two examples showing how to verify that the scanner is actually checking the FTP sessions. In order to do this we must make sure that the FTP session will go through the proxy (example: SGW appliance IP is 10.194.48.1).
The following prompt will be displayed: 220 Frox transparent ftp proxy. Login with username[@host[:port]] [client_ip][/client_username] User (10.194.48.1:(none)):
Enter the login details. For example: anonymous@ftp.zillionsofgames.com:21
After this the phase we have a connection to the remote FTP via the proxy (scanner). Any download operation will be examined by it.
Example of a ‘get’ request from the FTP server: ftp> get sampzeng.zip 200 PORT command successful. 150-Starting Transfer 150-There'll be a delay while we scan for viruses 150-Scanning file for viruses 150 Not starting Transfer 451 File contains virus. Aborting
To contact Trustwave about this article or to request support: